Some combination of the two. IBM i has its vulnerabilities, but because of the way that the OS is built, getting code execution accidentally is extremely diffic

Some combination of the two. IBM i has its vulnerabilities, but because of the way that the OS is built, getting code execution accidentally is extremely difficult, and even getting native code to run given full access to the system requires mucking about with the objects on disk. However, with IBM i comes PASE, which provides a AIX-like environment that can run most software built for AIX directly, and that's going to have the same sort of vulnerabilities as any other UNIX system. As far as I know, that's mostly used for new development, though, because developers don't like learning unfamiliar platforms.